CVE-2026-67631 is a critical (CVSS 9.8) heap based buffer overflow in Microsoft SQL Server. Microsoft's record says an unauthorized attacker could execute code over a network. It lists SQL Server 2017, 2019, 2022 and 2025. Install the Microsoft security update for your version and confirm the fixed build in Microsoft's advisory.
What's affected
- Product: Microsoft SQL Server, in these versions per the record: SQL Server 2017, 2019, 2022 and 2025.
- Weakness: CWE-122 heap based buffer overflow.
- Severity: CVSS 3.1 9.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No privileges or user interaction are needed. - Fixed version: not confirmed. Microsoft's page needs JavaScript and did not load for me, so check it for the fixed build of each SQL Server version.
How to check if you're exposed
Read the version of each SQL Server instance:
SELECT @@VERSION;
SELECT SERVERPROPERTY('ProductVersion') AS version, SERVERPROPERTY('ProductUpdateLevel') AS update_level;
Compare the build number with the fixed build in Microsoft's advisory for this CVE. I could not read that number from the advisory page, so confirm it there. Also find instances you may have forgotten: developer machines, test servers, and SQL Server Express copies embedded in applications. Note which instances accept connections from outside their own subnet.
What to do now
- Inventory SQL Server instances and their build numbers.
- Read Microsoft's advisory for the fixed build for each version you run.
- Install the update, testing first on a non production copy where you can.
- Restrict network access so only application servers and admin hosts can reach the SQL port.
- Confirm the new build number with SELECT @@VERSION after the restart.
Why it matters
A heap buffer overflow writes past the end of a block of memory allocated at run time, damaging neighbouring data. In a network service this is a classic route to code execution.
The vector is as bad as it gets for network exposure: no privileges, no user action, low complexity. The record lists four SQL Server versions, so most estates will have at least one affected instance. Microsoft does not report exploitation in the record and the CISA KEV flag is false. With a vector like this, the order of work is simple. Find every instance, narrow who can reach it, and patch.
Try it yourself
This walkthrough shows how findings across many servers are ranked so the broadest, most severe ones are handled first.
Click through it at your own pace, or open it full screen.
Quick check
Why patch this one first?
It has the highest score of the SQL Server CVEs in this group and the broadest version list, with a low complexity, no privilege network vector.
Does it need a login?
The vector says no privileges are required, so check network exposure first.
Sources
- Microsoft Security Response Center entry (listed in the record; its page needs JavaScript, so I could not read build numbers from it)
- Gold record for CVE-2026-67631
Last reviewed: 19 October 2026.
